240703-qx6vrsyhng_pw_infected.zip
- SHA256 cc87aab59cd2f26c132a5534bee45ce1a7c63d37da884ca1cbc9a8544710d317
Password
infected
Overview
overview
10Static
static
10source_prepared.exe
ubuntu-18.04-amd64
source_prepared.exe
debian-9-armhf
source_prepared.exe
debian-9-mips
source_prepared.exe
debian-9-mipsel
discord_to...er.pyc
ubuntu-18.04-amd64
discord_to...er.pyc
debian-9-armhf
discord_to...er.pyc
debian-9-mips
discord_to...er.pyc
debian-9-mipsel
get_cookies.pyc
ubuntu-18.04-amd64
get_cookies.pyc
debian-9-armhf
get_cookies.pyc
debian-9-mips
get_cookies.pyc
debian-9-mipsel
misc.pyc
ubuntu-18.04-amd64
misc.pyc
debian-9-armhf
misc.pyc
debian-9-mips
misc.pyc
debian-9-mipsel
passwords_grabber.pyc
ubuntu-18.04-amd64
passwords_grabber.pyc
debian-9-armhf
passwords_grabber.pyc
debian-9-mips
passwords_grabber.pyc
debian-9-mipsel
source_prepared.pyc
ubuntu-18.04-amd64
source_prepared.pyc
debian-9-armhf
source_prepared.pyc
debian-9-mips
source_prepared.pyc
debian-9-mipsel
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
debian9-armhf-20240418-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
source_prepared.exe
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
source_prepared.exe
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
discord_token_grabber.pyc
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
discord_token_grabber.pyc
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
discord_token_grabber.pyc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
discord_token_grabber.pyc
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
get_cookies.pyc
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
get_cookies.pyc
Resource
debian9-armhf-20240418-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
get_cookies.pyc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
get_cookies.pyc
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
misc.pyc
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
misc.pyc
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
misc.pyc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
misc.pyc
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
passwords_grabber.pyc
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
passwords_grabber.pyc
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
passwords_grabber.pyc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
passwords_grabber.pyc
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
source_prepared.pyc
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
source_prepared.pyc
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
source_prepared.pyc
Resource
debian9-mipsbe-20240418-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
source_prepared.pyc
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target 240703-qx6vrsyhng_pw_infected.zip
- Size 80.4MB
- Sample240703-szn4vawfle
- SHA256 cc87aab59cd2f26c132a5534bee45ce1a7c63d37da884ca1cbc9a8544710d317
- MD5 33e8cd92a4aef73aeb714ae22cab26f0
- SHA1 32c92e565512ecaa7821b6e54776090ad131404c
- SHA512 f3c1d88d0427012535cf5ae776013e542f86cd2f39033904bc6ee8a9e749279b1ed6d5829e7994d4e280f574ccd2462caeb1707f68604e367e58d6f9a79dabe0
- SSDEEP 1572864:Y0vejhmEpP6sJnZlruKmwypqS8iPnHQQy1VemMjfbvpqyC8ZLUvCxb:Y0GjhZn/qKmD8F1SfbBHC8ZLTp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule static1/unpack002/source_prepared.pyc pysilon - Pysilon family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/source_prepared.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/source_prepared.exe
File Explorer
-
240703-qx6vrsyhng_pw_infected.zip.zip 80.4MB
-
source_prepared.exe.exe 80.7MB
-
discord_token_grabber.pyc17KB
-
get_cookies.pyc10KB
-
misc.pyc5KB
-
passwords_grabber.pyc8KB
-
source_prepared.pyc180KB
source_prepared.exe
- IMPHASH 2ac23c52e7647c5bbea38e98bb68c652
- SHA256 b11384a3db715c4ed6c9dda48c0a07543f1eddc98031d6329b41269564545e91
- MD5 151d7708e147957fb7d0fb4dd9cadd6f
- SHA1 60b73ba56f2b502aebd183806c64e40081db4dc0
- SHA512 e7c20767ec74791bf6c3edec77c89404e9e72601f74104c7509d0ffdde4bcc446ab654e6278baf3ea89538ce92d5fab6327b4f743d5d88477cf0c5d0a4d63d3e
- SSDEEP 1572864:EvxZQglKSk8IpG7V+VPhqYdfCE70lgLiYgj+h58sMwFWuWDxNwJk:EvxZxwSkB05awcfAeF55HM3
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
48672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
GetEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
ExpandEnvironmentStringsW
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=143, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
discord_token_grabber.pyc
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
- MD5 e523026b612006e580e96bd9e2a8882c
- SHA1 03b9938701f7eff11a0c3632ed805e8188598c88
- SHA512 a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853
- SSDEEP 384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8
- MD5 SHA1 SHA512 SSDEEP
get_cookies.pyc
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
- MD5 b38f506528b3d6d5dbd851426c347b95
- SHA1 e91bf4ef42128267934e21be0176e552480f5977
- SHA512 ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
- SSDEEP 192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE
- MD5 SHA1 SHA512 SSDEEP
misc.pyc
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
- MD5 31aa260c6cdeaa9d942cd0dcfcadd16a
- SHA1 a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
- SHA512 0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
- SSDEEP 96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
- MD5 SHA1 SHA512 SSDEEP
passwords_grabber.pyc
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
- MD5 704dced7f7530b19a34a5f7a71c26b10
- SHA1 608d9647488cfa2b5f84a891028168a973bfcfa9
- SHA512 e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f
- SSDEEP 192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn
- MD5 SHA1 SHA512 SSDEEP
source_prepared.pyc
- SHA256 ea02450c807f6cc15598184aae7067db51ceeec8ae8e24642228dd939c234ec2
- MD5 683c7a6c055cd2771939f0032d9027ce
- SHA1 b45f5e5a2721c9412644dfbc691b1ef35ae8f932
- SHA512 2f10fd0f2cbe1bc39fb2b8e6e5439a79c227ae9e947168a1edc89ea4c61ca12f28e828b7bb0bcdaa32d7d8ea8774b9163efae773ecb8217f8d50f80631fc7ecf
- SSDEEP 3072:TwLagBA9oq8oolPEtelZN+thZaqPKg6NzZCknJ:MWgEEool8cN+rZaqPKg6NVCA
- MD5 SHA1 SHA512 SSDEEP
-
Detect Pysilon